Behavioral task
behavioral1
Sample
370f25fdcbbee0e3c32390a2d6bfae9c4049a22d1952b0ced9f93bb4a15fbce6.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
370f25fdcbbee0e3c32390a2d6bfae9c4049a22d1952b0ced9f93bb4a15fbce6.exe
Resource
win10v2004-20230915-en
General
-
Target
370f25fdcbbee0e3c32390a2d6bfae9c4049a22d1952b0ced9f93bb4a15fbce6
-
Size
756KB
-
MD5
e4004f7559e21443cdb7e868a9a49434
-
SHA1
92beabf6aecc1cc899460290ef248c9578f09cf3
-
SHA256
370f25fdcbbee0e3c32390a2d6bfae9c4049a22d1952b0ced9f93bb4a15fbce6
-
SHA512
e8b325cee15ba8a9d2605adde31698683b51b900ef664c6120daff05acd120c1a081d2ae1bfb91ed4a332fe8533fde9621f837591aee40480dda281b52120f1f
-
SSDEEP
12288:C9gn7iSxB6kZW4fFxSRRpKfvM2o7Nf75qtuKn8o5/DP4QWH6Yw0JFaK10d:C9gn7iSxB6uW4NxSRRpKfvM2mNf7ktuc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 370f25fdcbbee0e3c32390a2d6bfae9c4049a22d1952b0ced9f93bb4a15fbce6
Files
-
370f25fdcbbee0e3c32390a2d6bfae9c4049a22d1952b0ced9f93bb4a15fbce6.exe windows:4 windows x86
0892adfb91990f7a94e45fb9c22db7c1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateToolhelp32Snapshot
Process32First
Process32Next
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcess
GetLastError
GetVersionExA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
SetErrorMode
GetOEMCP
RtlUnwind
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
SetStdHandle
InterlockedExchange
WriteFile
SetFilePointer
TerminateProcess
OpenProcess
lstrcpyA
SetLastError
lstrcatA
LockResource
LoadResource
FindResourceA
GetVersion
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
GlobalDeleteAtom
MulDiv
LocalFree
FlushFileBuffers
lstrcpynA
TlsAlloc
GlobalHandle
TlsFree
LCMapStringA
LoadLibraryA
FreeLibrary
GetCommandLineA
GlobalFree
GetStartupInfoA
CreateProcessA
WaitForSingleObject
FindFirstFileA
RemoveDirectoryA
DeleteFileA
FindNextFileA
FindClose
GetTickCount
WritePrivateProfileStringA
GetPrivateProfileStringA
CreateFileA
GetFileSize
GlobalReAlloc
ReadFile
GetModuleFileNameA
IsBadReadPtr
HeapReAlloc
ExitProcess
GetModuleHandleA
VerLanguageNameW
LocalAlloc
GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
GlobalUnlock
GlobalLock
GlobalAlloc
RtlZeroMemory
GetAtomNameW
IsDebuggerPresent
WideCharToMultiByte
GetProcAddress
CreateThread
CloseHandle
SetWaitableTimer
CreateWaitableTimerA
MoveFileA
CreateDirectoryA
GetCurrentProcessId
VirtualFree
VirtualAlloc
Sleep
GetLocalTime
GlobalMemoryStatusEx
HeapDestroy
MultiByteToWideChar
lstrcatW
lstrlenW
lstrcmpA
lstrlenA
HeapFree
InterlockedDecrement
InterlockedIncrement
GetProcessHeap
RtlMoveMemory
LocalSize
HeapAlloc
HeapCreate
GetCPInfo
IsBadCodePtr
user32
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
CreateWindowExA
GetClassLongA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
GetWindowPlacement
IsDialogMessageA
SendDlgItemMessageA
SetWindowTextA
GetDlgCtrlID
CreateDialogIndirectParamA
UnhookWindowsHookEx
GrayStringA
DrawTextA
TabbedTextOutA
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
SetMenuItemBitmaps
EnableMenuItem
CallNextHookEx
SetWindowsHookExA
GetLastActivePopup
PostMessageA
GetWindow
PtInRect
GetWindowLongA
GetWindowTextA
SetWindowLongA
FindWindowA
GetClassNameA
SendMessageA
SetActiveWindow
GetActiveWindow
GetForegroundWindow
MessageBoxA
SetMenuDefaultItem
SetMenuItemInfoW
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetClientRect
GetMenuDefaultItem
GetMenuState
GetMenuItemRect
GetMenuStringW
TrackPopupMenu
SetForegroundWindow
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuW
AppendMenuW
GetMenuItemInfoW
GetMenuItemCount
DestroyMenu
GetMenuInfo
LoadMenuW
GetSystemMenu
CreatePopupMenu
CreateMenu
DrawIconEx
LoadImageW
CreateIconFromResourceEx
GetDoubleClickTime
ClientToScreen
LoadIconW
PostQuitMessage
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
TranslateMDISysAccel
IsChild
GetMessageW
UpdateLayeredWindow
WindowFromDC
CopyRect
SetCursor
DestroyCursor
AdjustWindowRectEx
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
SendMessageW
GetWindowLongW
GetWindowTextW
GetWindowTextLengthW
FindWindowExW
IsWindow
GetAsyncKeyState
SetWindowLongW
GetParent
GetDlgItem
LoadStringA
UnregisterClassA
PostThreadMessageA
wsprintfA
DispatchMessageA
GetMessageA
PeekMessageA
GetDesktopWindow
SystemParametersInfoA
GetCursorPos
TrackMouseEvent
EndPaint
BeginPaint
GetKeyState
RegisterWindowMessageW
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
SetRect
SetWindowRgn
SystemParametersInfoW
EnumPropsExW
RemovePropA
RemovePropW
GetPropA
GetPropW
SetPropA
SetPropW
KillTimer
SetTimer
MessageBoxW
SetWindowTextW
SetParent
MoveWindow
UpdateWindow
ValidateRect
ScreenToClient
GetFocus
GetIconInfo
CopyIcon
GetClassNameW
PostMessageW
ShowWindow
DefWindowProcW
CreateMDIWindowW
DialogBoxParamW
CreateDialogParamW
EndDialog
DialogBoxIndirectParamW
DestroyWindow
SetClassLongW
GetClassLongW
CreateDialogIndirectParamW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
InvalidateRect
ReleaseDC
GetDC
CallWindowProcW
SetFocus
GetNextDlgTabItem
GetAncestor
MsgWaitForMultipleObjects
GetWindowThreadProcessId
CreateWindowStationA
GetWindowRect
SetWindowPos
EnableWindow
IsWindowVisible
IsWindowEnabled
GetSysColor
DestroyAcceleratorTable
DestroyIcon
LoadCursorW
ReleaseCapture
SetCapture
shell32
SHGetSpecialFolderPathA
DragFinish
DragQueryFileW
Shell_NotifyIconW
ShellExecuteA
DragAcceptFiles
CommandLineToArgvW
ole32
OleIsCurrentClipboard
OleFlushClipboard
CLSIDFromString
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
StringFromGUID2
GetHGlobalFromStream
shlwapi
PathFindFileNameW
PathFindFileNameA
PathFindExtensionA
PathFileExistsA
PathRemoveFileSpecW
ws2_32
inet_ntoa
WSACleanup
select
WSAAsyncSelect
ntohs
getsockname
recv
send
connect
htons
inet_addr
socket
closesocket
WSAStartup
gethostbyname
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
gdi32
CreateCompatibleBitmap
GetObjectA
GetDIBits
CreatePatternBrush
CreateFontIndirectW
GetObjectW
CreateSolidBrush
GetStockObject
SetStretchBltMode
GetStretchBltMode
CreateDIBSection
CreateCompatibleDC
BitBlt
CreateRoundRectRgn
GetTextMetricsA
SetBkColor
SetBkMode
SetTextColor
DeleteDC
SelectObject
DeleteObject
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
Escape
RestoreDC
SaveDC
CreateBitmap
GetDeviceCaps
StretchBlt
comctl32
ord17
InitCommonControlsEx
wininet
InternetGetConnectedState
InternetOpenUrlA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenA
gdiplus
GdipCreateBitmapFromFile
GdipIsMatrixEqual
GdipIsMatrixInvertible
GdipVectorTransformMatrixPoints
GdipTransformMatrixPoints
GdipShearMatrix
GdipScaleMatrix
GdipInvertMatrix
GdipRotateMatrix
GdipTranslateMatrix
GdipMultiplyMatrix
GdipGetMatrixElements
GdipSetMatrixElements
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipGetRegionScans
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipIsVisiblePathPoint
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreatePath
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipCloneBitmapArea
GdipCreateBitmapFromStream
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipCreateFont
GdipGetImageGraphicsContext
GdipCreateFromHWND
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdiplusStartup
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipBitmapSetResolution
GdipCreateSolidFill
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromHICON
GdipGetFontSize
GdipCreateBitmapFromResource
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilyMonospace
GdipGetFamilyName
GdipIsStyleAvailable
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipCreateTexture
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPointsI
GdipGetLineSpacing
GdipGetFontUnit
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipDeleteRegion
GdipDeletePath
GdipDeleteFont
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipIsMatrixIdentity
msimg32
AlphaBlend
atl
ord42
oledlg
ord8
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
winspool.drv
DocumentPropertiesA
OpenPrinterA
ClosePrinter
Sections
.text Size: 660KB - Virtual size: 657KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 52KB - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ